# Evidence index — Azure PR-watch checks

Captured for [#18759](https://git.cafe/pingdotgg/t3code/pulls/18759) / [#18759 on GitHub](https://github.com/pingdotgg/t3code/pull/18759). This is an evidence capture, not a merge verdict.

**live Azure DevOps not exercised**. Every Azure response is a **synthetic sanitized fixture**, constructed from repository test shapes. No genuine live CLI recording or correlated build-result recording was supplied. Synthetic context/build IDs are fixture metadata; production reads policy evaluations, and no pipeline-build/history request is fabricated.

BEFORE [3cc31ed27c](https://github.com/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b) is the requested origin/main baseline. AFTER [e13265440a](https://github.com/pingdotgg/t3code/commit/e13265440a44b51116f9c3427b50c3d0e2c3ca1e) is the final requested head. Original contributor provenance is [da81b1d76d](https://github.com/AugusDogus/t3code/commit/da81b1d76d071cd52150c590d55ef4ae945b2054), not the baseline.

## Result

- Required runtime rows **R1–R4: 4/4 captured BEFORE and AFTER** using identical fixtures and logical times. All 32 paired full-detail observations are checked for input/time equality.
- BEFORE replay: **73 assertions**, 96 real stub subprocesses, exit 0. AFTER replay: **140 assertions**, 141 real stub subprocesses, exit 0. Assertions include external focused decoder and pagination cases, not 140 independent end-to-end scenarios.
- Requested four focused files: BEFORE **81 passed**, AFTER **84 passed**, exit 0. Additional existing AzureDevOpsCli suite: **7 passed on each**, exit 0. Totals: 88 BEFORE / 91 AFTER; no repository test suite was added or expanded by this capture.
- Exactly the **three new regression tests fail on BEFORE** (exit 1, 33 skipped) and **pass on AFTER** (exit 0, 33 skipped). The wider experiment porting both complete AFTER test files also fails an existing latest-head test because its new queued policy response misaligns the BEFORE request sequence; this fourth failure is fixture incompatibility, not a claimed head regression. The absent optional preview reader accounts for the new preview test's BEFORE TypeError; the runtime replay uses the actual service fallback selection and BEFORE preview succeeds.
- Independent rebuild driver executed end to end from fresh exports, including focused tests, paired replays, and the expected BEFORE failures. All eight recorded commands returned their expected exit codes.

## Coverage accounting

All **16 affected matrix rows** have supporting runtime, focused assertion, repository-test, or source-trace evidence, with the rate-limit runtime exception below. T1 is captured separately in the focused logs. The matrix itself remains a specification, not proof.

| Matrix rows | Actual supporting evidence |
| --- | --- |
| D1–D4 | External decoder assertions: statuses and case, unknown/broken, strict malformed/filtered rows, names and null/blank settings, IDs, build/evaluation identity, accepted extra fields; raw checks are also logged in R1/R2. |
| C1 | R2 real subprocess pages skip 0/100; first page 100 non-build policies emits no checks, second page yields three. Exact flags/cwd/order are asserted from argv logs. |
| C2 | AFTER real subprocess 0,99,100+empty,999,1000 boundaries; 1000 fails at skip900 and never requests skip1000. |
| C3 | R3 passing first page followed by object/invalid JSON/malformed row/real oversized output; all fail closed. Extra actual collector call proves stdoutTruncated=true with a valid JSON prefix. |
| C4 | Real generic/auth/not-found subprocess failures and real missing executable; focused Azure CLI error mapping plus provider/reactor source trace for rate limiting. **Production-host rate-limit classification and a running reactor's pause were not exercised.** |
| P1 | Actual show → policy pages → iterations → iteration changes; checks feed unchanged production evaluator and formatter. |
| P2 | R4 latest iteration C defeats stale PR trial A; empty/error iterations and missing location retain populated checks. Existing focused test covers head preservation when file counting fails. |
| P3 | R3 optional preview reader returns exactly seven fields with only show argv under policy denial; full detail fails at policy. Show errors propagate. Summary/list and unsupported separate checks/fingerprint selection are source-traced; no UI or full service-cache runtime asserted. |
| W1 | R1 running/failure/duplicate/queued/success/duplicate with next-state carry and actual formatted messages. |
| W2 | R2 required fail → required pass count2 with optional pending → optional completion count3 → duplicate suppressed. |
| W3 | R3 read errors skip evaluation and retain the replay's in-memory watch, recovery suppresses the prior failure, a pending rerun permits a fresh failure. Existing reactor error branch traced; persisted state is not tested. |
| W4 | R4 pass on A → pending on latest C clears remembered pass → pass on C. |
| W5 | R4 same-head empty/all-filtered checks preserve prior pass; a new empty watch at logical +16min emits no invented timeout notice with actual Azure capabilities. |

## Environment and scope

Machine `fs-15`, Linux-6.1.102-x86_64-with-glibc2.39, Node v24.22.1. Fresh git-archive exports import production modules from their own exact revisions. Only installed dependency directories are linked. Source hashes are verified byte-for-byte against git objects in environment.json. Fixtures and runtime replay script are byte-identical to the prior audited proof.

The production `AzureDevOpsPullRequestProvider.make`, PR CLI layer and Azure CLI layer run through the default `TestSourceControlHost.layerWithRealGit` subprocess runner, not mocked execute responses. Its executable PATH stub logs argv, cwd, scenario, event, sequence, selected fixture and exit. There is no real az fallback or network code in the stub. The verified rebuild strips ambient Azure/provider credential variables from child environments without exposing their values. No server, browser, database, live watch, or ~/.t3 read was needed. The subprocess cwd is the temporary proof directory; Azure's real --detect behavior is not tested by synthetic CLI output.

This proves **runtime provider-to-watch decisions and formatted messages**, not durable enqueue or an agent waking. Source trace covers detail propagation, preview reader selection, reactor error handling, and changes → record → woke. There is no frontend/render change; no visual evidence is required or claimed.

All refreshed artifacts are under `/tmp/to-18759-e132-proof` and `/tmp/to-18759-e132-driver`. Checkout remains clean at final AFTER. No source edits, ref switches, commits, pushes, comments, watches, browser or server launches. App-owned replacement PR linking only. The canceled prior capture was inspected but no partial results were reused. All eight fresh commands completed with expected exits.

## Missing or unverified

- Live Azure credentials, recordings and actual Azure DevOps service behavior.
- Correlated recorded build-result JSON (none supplied).
- Persisted watch record/enqueue, reactor scheduling, agent startup and notifications delivery.
- Production process-host rate-limit classification and live reactor pause. The approved helper lacks generic failure classification: synthetic 429 stderr correctly appears as `failed` in this replay. The existing focused test preserves a typed `rate-limited` error; the provider mapper and reactor early-return are traced, not re-labelled runtime proof.

No required R1–R4 runtime row is missing. No UI/browser proof is claimed.

## Rebuild

Extract the complete bundle, enter its `pr-18759-proof` directory and run:

```sh
python3 rebuild-proof.py --repo /absolute/path/to/installed/t3code --out /tmp/new-pr-18759-proof
```

Use a new external output directory and an installed repository containing both exact git objects and the unchanged lockfile dependencies. The driver exports both revisions, links only dependency directories, regenerates deterministic fixtures/hashes, runs fresh processes with identical times, runs the focused tests, and ports only test files into the external BEFORE export for the expected failures. It refuses to overwrite an existing proof or write inside the supplied repository. Complete final runtime output and every command exit are retained. Public `SHA256.json` covers bundled files; `fixture-manifest.json` covers every JSON fixture. Prior harness construction failures remain in the earlier proof; no new harness corrections were required for this refresh.



## Refresh provenance and friction

Replacement [#24568](https://github.com/pingdotgg/t3code/pull/24568). Prior sufficiency audit remains `/tmp/to-18759-pass2-audit/PASS2-audit.md`; this is a fresh final-head evidence capture, not a fresh independent audit. Main merge plus final named-span tracing fix were incorporated through exact exports. No broad port experiment was rerun; its prior fourth fixture mismatch is disclosed above and excluded.

Friction: infra — approved test process helper omits generic production rate-limit classification, as disclosed; first standalone-index upload returned a transport error after the other seven uploads succeeded, retried once. tool|brief|runbook|forge|policy|model|other: none for this refresh.

Upload workflow: [ghdrop skill](/home/ubuntu/.codex/skills/ghdrop/SKILL.md).


## Final uploaded artifacts

[proof-bundle.tar.gz](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6594af388c1f5073/proof-bundle.tar.gz) — local `/tmp/to-18759-e132-proof/proof-bundle.tar.gz`.

[matrix.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9f3106d270736ca7/matrix.md) — local `/tmp/to-18759-e132-proof/matrix.md`.

[runtime-transcript.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/745e63c12d909b5e/runtime-transcript.md) — local `/tmp/to-18759-e132-proof/runtime-transcript.md`.

[source-trace.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b5dbae22f2a3e106/source-trace.md) — local `/tmp/to-18759-e132-proof/source-trace.md`.

[before-runtime.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e1f5c306b2ea659f/before-runtime.log) — local `/tmp/to-18759-e132-proof/before-runtime.log`.

[after-runtime.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/107a2f5043e04df3/after-runtime.log) — local `/tmp/to-18759-e132-proof/after-runtime.log`.

[commands.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3ede5763c5a05e04/commands.json) — local `/tmp/to-18759-e132-proof/commands.json`.

The bundle includes all fresh focused logs, exact test sources, argv logs, synthetic fixtures/manifest, executable stub, rebuild/replay/report/packaging scripts, environment/source hashes and SHA256 index. Its embedded index is the pre-upload version; this standalone index adds upload links.